PT-2018-18411 · Docker+2 · Docker Compose+2

Published 2018-03-11 · Updated 2018-04-12 · CVE-2018-8059

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: SUSE Portus version 2.3

Description: The issue arises from the Djelibeybi configuration examples for NGINX in SUSE Portus, specifically when these configurations are applied to setups involving Docker Compose. The problem is a Missing SSL Certificate Validation issue, which occurs because the configurations do not utilize any proxy ssl * directives. This oversight can lead to security risks, as it may allow for unvalidated SSL certificates to be used.

Recommendations: For SUSE Portus version 2.3, consider adding the necessary proxy ssl * directives to the NGINX configuration to enable proper SSL certificate validation, especially in setups involving Docker Compose. As a temporary workaround, review and manually validate SSL certificates for all connections until a properly configured version is available.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2018-8059

Affected Products

Docker Compose

Nginx

Suse Portus

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2018-8059 · Security Note
• https://osv.dev/vulnerability/CVE-2018-8059 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/140144 · Note
• http://openwall.com/lists/oss-security/2018/03/07/4 · Note